consolidate npm publishing for trusted publishing (OIDC) - #26

Merged

iamalwaysuncomfortable merged 8 commits into

mainfrom

npm-trusted-publishing

Jul 29, 2026

Commits on Jul 29, 2026

consolidate npm publishing into npm-publish.yml
iamalwaysuncomfortable
committed
make npm publish fail the release run, publish from the tag, and retry safely
iamalwaysuncomfortable
committed
address review findings: clock skew, prerelease semver, shell interpolation
iamalwaysuncomfortable
committed
identify the dispatched npm-publish run by id instead of timestamp guessing
iamalwaysuncomfortable
committed
restrict npm publishing to stable tags and never publish backwards
iamalwaysuncomfortable
committed
only the newest stable tag may be published to npm
iamalwaysuncomfortable
committed
preinstall semver and match the dispatch id exactly
iamalwaysuncomfortable
committed
pin the semver CLI to an exact version
iamalwaysuncomfortable
committed